Hospital Management System In Php
CVE-2023-5004
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Hospital management system version 378c157 allows to bypass authentication.
This is possible because the application is vulnerable to SQLI.
AnalysisAI
Hospital management system version 378c157 allows to bypass authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as SQL Injection (CWE-89), which allows attackers to execute arbitrary SQL commands against the database. Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI. Affected products include: Projectworlds Hospital Management System In Php. Version information: version 378.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized queries/prepared statements. Never concatenate user input into SQL. Apply least-privilege database permissions.
Hospital management system version 378c157 allows to bypass authentication. Rated critical severity (CVSS 9.8), this vul
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php. R
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today